CVE-2022-48434

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48434
libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/cc867f2c09d2b69cee8a0eccd62aff002cbbfe11 Mailing List Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KOMB6WRUC55VWV25IKJTV22KARBUGWGQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQHNSWXFUN3VJ3AO2AEJUK3BURSGM5G2/
https://news.ycombinator.com/item?id=35356201 Exploit Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202312-14
https://wrv.github.io/h26forge.pdf Technical Description
Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
History

23 Dec 2023, 12:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOMB6WRUC55VWV25IKJTV22KARBUGWGQ/', 'name': 'FEDORA-2023-1e24db98a6', 'tags': [], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQHNSWXFUN3VJ3AO2AEJUK3BURSGM5G2/', 'name': 'FEDORA-2023-32c3bbbbc9', 'tags': [], 'refsource': 'FEDORA'}
  • () https://security.gentoo.org/glsa/202312-14 -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQHNSWXFUN3VJ3AO2AEJUK3BURSGM5G2/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KOMB6WRUC55VWV25IKJTV22KARBUGWGQ/ -

22 Apr 2023, 03:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOMB6WRUC55VWV25IKJTV22KARBUGWGQ/ -
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PQHNSWXFUN3VJ3AO2AEJUK3BURSGM5G2/ -
References (MISC) https://news.ycombinator.com/item?id=35356201 - (MISC) https://news.ycombinator.com/item?id=35356201 - Exploit, Issue Tracking, Third Party Advisory
References (MISC) https://wrv.github.io/h26forge.pdf - (MISC) https://wrv.github.io/h26forge.pdf - Technical Description
References (MISC) https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/cc867f2c09d2b69cee8a0eccd62aff002cbbfe11 - (MISC) https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/cc867f2c09d2b69cee8a0eccd62aff002cbbfe11 - Mailing List, Patch
CWE CWE-416
CPE cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1

29 Mar 2023, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-29 17:15

Updated : 2024-10-21 16:35

NVD link : CVE-2022-48434

Mitre link : CVE-2022-48434

CVE.ORG link : CVE-2022-48434

JSON object : View

Products Affected

ffmpeg

  • ffmpeg
CWE
CWE-416

Use After Free